PT-2021-9019 · Red Hat · Undertow+2

Published 2021-03-23 · Updated 2022-05-03 · CVE-2019-19343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.0.25.SP1 jboss-remoting versions prior to 5.0.14.SP1 Red Hat Jboss EAP versions prior to 7.2.4

Description A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. This issue is related to the use of Remoting in Undertow.

Recommendations For Undertow versions prior to 2.0.25.SP1, update to version 2.0.25.SP1 or later to resolve the issue. For jboss-remoting versions prior to 5.0.14.SP1, update to version 5.0.14.SP1 or later to resolve the issue. For Red Hat Jboss EAP versions prior to 7.2.4, update to version 7.2.4 or later to resolve the issue.

Fix

DoS

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

CVE-2019-19343

Affected Products

Red Hat Jboss Eap

Undertow

Jboss-Remoting

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2019-19343 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19343 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19343 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19343 · Vendor Advisory
• https://issues.redhat.com/browse/JBEAP-16695 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19343 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19343 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1780445 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220211-0002 · Note
• https://t.me/cvenotify/29608 · Telegram Post
• https://t.me/cibsecurity/25343 · Telegram Post